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ABSTRACT 

The  fundamental  objectives  of  the  capstone  design 
project  in  the  Department  of  Astronautics  at  the  United 
States  Air  Force  Academy  (USAFA)  are  for  cadets  to 
leam  important  engineering  lessons  by  executing  a  real 
space  mission  on  a  Department  of  Defense-funded 
satellite  project.  FalconSAT-3  is  a  50  kg,  gravity 
gradient- stabilized  designed  and  built  by  cadets  and 
launched  March  2007  on  the  first  ESPA  (Enhanced 
extended  launch  vehicle  Satellite  Payload  Adapter) 
mission.  FalconSAT-3  was  one  of  six  satellites 
integrated  onto  the  launch  vehicle  and  the  nature  of  the 
mission  made  it  that  the  satellite  was  subject  to  the  full 
formality  of  testing  requirements.  Two  successive 
gravity  gradient  booms  failed  either  design  requirements 
or  environmental  testing;  design  requirements  grew 
dramatically  during  the  design  phase;  ambiguous 
thermal  vacuum  test  results  led  to  uncertainty  at  launch; 
and  after  launch  it  was  not  possible  to  contact  the 
satellite  for  several  weeks. 

1.  INTRODUCTION 

The  successful  resolution  of  these  problems,  and  the 
continuing  on-orbit  operations  -  and  software 
development  -  has  resulted  in  several  hard-won  lessons 
for  four  successive  classes  of  cadets.  This  paper  will 
describe  and  discuss  several  important  issues  for 
academic,  small  satellite  programs.  There  are  several 
constraints  on  a  satellite  program  whose  primary  focus 
is  undergraduate  education  that  lead  to  interesting 
design,  testing,  and  operational  decisions. 

First,  uncertainty  about  launch  loads  and  severe  risk 
avoidance  by  the  Program  Office  led  to  vibration  testing 
at  1 5  grms  and  detailed  finite  element  analyses  that 
were  strenuous  for  the  program.  Secondly,  the  first 
gravity  gradient  boom  was  an  experimental  "memory 
composite"  device  whose  first  delivery  was  too,  big,  too 
late,  and  not  functional.  The  "proven"  COTS 
replacement  failed  miserably  and  the  late  procurement 
of  a  quality  COTS  item  required  obtaining  last-minute 
safety  approvals  for  pyrotechnics  and  gyrations  in  the 
testing  program.  The  original  simple  software 
requirements  evolved  into  the  need  for  three-axis 
control  and  ambiguous  thermal-vacuum  testing  results 


of  the  flight  computer  forced  the  cadets  to  make  critical 
program  decisions  as  the  integration  and  launch  date 
inexorably  marched  to  its  own  schedule. 

After  a  successful  launch,  the  cadet  ground  station  was 
not  able  to  communicate  with  the  satellite  for  several 
weeks  and  the  anomaly  resolution  processes  and 
subsequent  recovery  and  operational  experiences  have 
given  the  cadets  an  appreciation  for  why  space  is  hard 
and  we,  as  space  professionals,  often  can  leam  from  the 
wisdom  of  the  neophytes.  The  current  state  of  satellite 
operations  is  described  with  an  emphasis  on  the  kinds  of 
significant  technical  contributions  that  can  be  made  by 
undergraduates. 


2.  DESIGN  REQUIREMENTS  AND 
CONSTRAINT 

2.1.  Mission  and  Payloads 

The  scientific  mission  of  the  FalconSAT-3  program  is  to 
fly  three  Space  Experiments  Review  Board  (SERB) 
experiments  on  a  Space  Test  Program  (STP)  provided 
launch  vehicle.  The  educational  mission  of  the  program 
is  to  provide  a  real-world,  Department  of  Defense 
(DoD)  funded  project  that  teaches  cadets  about  the 
entire  design  /  build  /  test  /  operational  cycle  of  space 
programs  by  requiring  them  to  perform  as  many  of  these 
functions  and  capabilities  as  possible.  The  students  are 
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Figure  1.  FalconSAT-3  External  View 


in  their  fourth  year  of  an  undergraduate  engineering 
program  and  participate  in  this  capstone  engineering 
course  for  two  semesters.  There  are  no  graduate 
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students  and  the  role  of  the  faculty,  and  a  very  small 
number  of  contractors,  is  to  teach  and  mentor  and  only 
do  those  tasks  that  are  reasonably  beyond  the  abilities  of 
undergraduate  engineers. 


•  FalconSAT-3  meets  DoD  science  objectives  with  three  payloads 
•The  third  SERB  payload  also  meets  DoD  technology  objectives  by 
demonstrating  new  thruster  technology 


•  PLANE 

•  Investigate  ambient  plasma 

•  Demo  new  sensor 

•  Developed  by  SPARC 

•  AFOSR  tie-in 

•  FLAPS 

•  Investigate  plasma  morphology 

•  Demo  new  instrument 

•  Developed  by  S PARC/NAS A/APL 


•  Shock  Ring 

•  AFRLA/S  tech  demo 

•  High  freq  vibration  isolation 

•  Orbital  Parameters: 

•  Launched  9  March  2007 

•  OrbitalAltitude-560km 

•  Inclination -35.4  deg 

•  Eccentricity- NearCircular 


■  MPACS 

•  Demo/characterize  new  propulsion  technology 

•  Establish  flight  heritage  for  AFRL/PR 

•  m-PPT  invented,  modeled  under  AFOSR  funding 


Figure  2.  FalconSAT-3  Mission 


The  satellite  was  required  to  support  five  separate 
payloads.  The  two  primary  SERB  payloads  were  plasma 
instruments  known  as  PLANE  and  FLAPS.  PLANE 
(plasma  local  anomalous  noise  environment)  is  a  new 
plasma  sensor  developed  in  the  Space  and  Atmospheric 
Research  Center  (SPARC)  in  the  Department  of  Physics 
at  USAFA  and  is  designed  to  measure  the  boundary 
layer  effects  on  plasma  flow  around  a  spacecraft. 
FLAPS  (flat  plasma  spectrometer)  is  another  plasma 
instrument  (jointly  developed  with  SPARC,  NASA  and 
JHU/APL)  and  it  is  designed  to  measure  and  understand 
ambient  plasma  morphology  such  as  “plasma  bubbles” 
and  other  inhomogeneous  structures  in  the  background 
ionosphere.  The  third  payload  is  MPACS,  which  is  a 
miniature  pulsed-plasma  thruster,  and  the  goal  is  to 
demonstrate  operation  on  orbit.  The  fourth  payload  was 
an  experimental  composite  gravity  gradient  boom  and 
the  fifth  payload  was  a  shock  ring  adaptor  that  was 
intended  to  reduce  the  high  frequency  vibration 
environment  that  coupled  into  the  satellite  during 
launch. 
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Figure  3.  FalconSAT-3  Mission  Architecture 


The  orbital  requirements  for  the  satellite  were  a  560  km 
circular  orbit  at  a  35.4°  inclination.  The  only  ground 
station  for  this  satellite  is  at  USAFA  at  latitude  39°  and 
that  has  made  closing  the  link  budget  and  successful 
communication  difficult  to  manage. 


2.2.  Launch  Vehicle  and  Programmatics 

The  launch  vehicle  chosen  for  this  mission  was  an  Atlas 
V  heavy-lift  rocket  that  had  the  Orbital  Express  satellite 
as  its  primary  spacecraft.  The  launch  vehicle  was  also 
required  to  fly  the  first  ESPA  ring,  which  has  been 
designed  to  accommodate  as  many  as  six  secondary 
satellites.  The  ESPA  Users  Guide  [1]  defines  the 
general  requirements  for  the  secondary  spacecraft  and 
those  are  summarized  in  Tab.  1. 


mass 

181  kg 

volume 

60.96  x  71.12  x  96.52  cm 

Centre  of  gravity 

50.8  cm  from  mounting 

Fundamental  frequency 

>35  Hz 

Table  1  ESPA  Requirements 
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Results  from  the  STS-60  mission  indicate  that  a  turbulent 
component  of  the  plasma  shares  the  motion  of the  spacecraft. 
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Description 

PLANE  will  use  a  pair  of  planar 
retarding  potential  analyzers  (RPAs), 
linked  by  a  feedback  loop,  to  distinguish 
ambient  ions  from  those  moving  with  the 
same  speed  and  direction  as  the  spacecraft. 


Figure  4.  PLANE  Objectives 


The  mounting  ring  separation  system  required  for  this 
mission  was  a  15  in  (38.1  cm),  24-bolt  motorized  (or 
non-motorized  for  FalconSAT-3)  lightband  from 
Planetary  Systems  Corporation  (PSC).  This  system 
eliminates  the  pyroshock  from  a  pyrotechnic  initiated 
separation  system  and  provides  a  controlled,  spring 
force-driven  separation  from  the  launch  vehicle. 


Figure  5.  FalconSAT-3  mounted  on  ESPA  Ring 


Because  of  the  complex  nature  and  importance  of  the 
primary  spacecraft  on  this  mission  FalconSAT-3  was 
required  to  meet  all  of  the  safety  requirements  imposed 
by  the  integrating  contractor  (IC),  the  launch  vehicle 


provider,  the  Eastern  Test  Range  (ETR),  and  STP.  From 
an  educational  perspective  the  insights  gained  by  cadets 
into  the  complexity,  and  bureaucracy,  of  the  aerospace 
industry  was  extremely  enlightening.  From  the 
perspective  of  a  small  team  building  a  satellite  the 
documentation,  analyses,  and  reporting  requirements 
became  a  daunting  task  unto  itself. 

t-.  ,  .  c  Description 

■  Determine  importance  of  non-  ' 

Maxwellian  plasma  distributions  in  FLAPS  is  a  Micro-Electromechanical 


2.3.  Academic  Schedules 

The  schedule  of  the  students  is  dictated  by  the  USAFA 
academic  calendar  and  their  numerous  duties  and 
responsibilities  outside  of  the  classroom.  The  schedule 
of  the  satellite  is  dictated  by  the  sponsor  providing  the 
funding  and  launch  and  integration  schedule  of  the 
primary  mission  satellite.  In  addition,  the  nominal  four 
year  period  from  start  of  the  project  to  launch  and  early 
on-orbit  operations  involves  four  separate  graduating 
classes  of  students  who  annually  depart  in  May  before 
their  replacements  from  the  next  class  arrive  in  August. 
This  one  hundred  percent  turnover  in  the  workforce 
every  year  makes  project  documentation  absolutely 
critical  to  the  success  of  the  program  -  and  one  of  the 
most  important  lessons  the  students  will  learn. 

2.4.  Life  of  a  Secondary  Payload 


Figure  7.  FalconSAT-3  Internal  View 


and  to  require  no  services  except  the  ability  to  charge 
batteries  every  30  days.  This  ensures  that  the  satellite 
can  be  launched  into  any  lighting  conditions.  The  last 
functional  test  of  the  satellite  is  prior  to  integration  and 
there  will  be  no  further  state  of  health  information  from 
the  satellite  until  communication  is  established 
sometime  after  separation  on  orbit.  While  in  theory  the 
satellite  could  be  launched  with  dead  batteries  and  then 
be  charged  on-orbit  before  any  operations  can 
commence,  that  additional  risk  is  unnecessary  as  long  as 
is  it  possible  to  charge  the  batteries.  For  this  launch  that 
meant  the  ground  crew  connected  to  the  FalconSAT-3 
batteries  through  a  500  foot  umbilical  cable.  This  class 
of  satellites  waits  until  the  launch  vehicle  separation 
switch  is  tripped  on  orbit  and  then  battery  power  is 
connected  to  the  critical  components. 


3.  TESTING  CAMPAIGNS 

The  development  philosophy  of  the  Smallsat  program  at 
USAFA  is  strongly  focused  on  testing  at  several  stages. 
While  the  students  are  required  to  do  as  much 
theoretical  and  analytical  design  as  is  reasonable  at  the 
undergraduate  level  the  critical  educational  goals  are 
best  met  by:  extensive  emphasis  on  assembly 
procedures  and  practices;  integration  at  the  subsystem, 
system,  spacecraft,  and  launch  vehicle  level;  and,  testing 
at  all  levels. 

3.1.  Test  Articles 

Typically  the  testing  approach  includes  four  separate 
stages.  The  first  stage  is  the  construction  of  a  physical 
model.  The  physical  model  can  be  constructed  of 
cardboard  or  plywood  and  serves  as  a  means  to 
visualize  what  the  spacecraft  will  look  like  and  how 
payloads,  avionics,  and  wire  harness  can  be 
accommodated.  This  is  where  the  initial  trade-off 
studies  and  design  decisions  are  made. 


In  order  for  a  secondary  payload  to  receive  the 
maximum  probability  of  being  manifested  on  any 
launch  vehicle  it  must  be  designed  to  require  the 
absolute  minimum  effort  to  be  integrated  and  limited 
services  after  encapsulation.  As  a  result  FalconSAT-3 
was  designed  to  be  powered  OFF  after  encapsulation 


SEM 


QM 


May  03,  Jan  04 
Dynamic  testing 

■  validate  design 

■  determine  shock 
ring  performance 
with  lightband 


-  Feb  05 

■  Dynamic  testing 

■  verify  design 

■  boom  failure 

■  Thermal-Vac 

■  identify  component 
problems 


Figure  9.  FalconSAT-3  test  Sequence 


The  second  major  item  is  a  structural  engineering  model 
(SEM).  The  SEM  is  a  duplicate  of  the  satellite  structure 
that  will  be  flown  and  the  avionics  and  payload 
components  are  simulated  using  mass  dummies.  The 
mass  and  volume  of  the  SEM  are  the  same  as  the  flight 
model  and  are  subjected  to  a  vibration  and  shock 
environment  that  determines  whether  or  not  the 
structural  design  is  adequate  to  handle  the  launch  loads. 
The  SEM  test  is  also  instrumented  well  enough  to 
identify  variations  in  the  defined  launch  load 
environment  that  can  be  seen  at  various  places  in  the 
structure. 

>  T echnology  demonstration  of  precision-controlled,  low-thrust  micro  plasma  pulsed  thrusters  for  future 
attitude  control  applications 

>  Operate  MPACS  in  excess  of  90  hours  on  orbit 

•  Firing  9/12  thrustertubes  due  to  FM  test  results 

Determine  thrust  provided  by  MPACS  by  measuring  change  in  satellite  dynamics 

•  Yaw  axis  will  achieve  best  results  based  upon  sensoraccuracy 


Figure  10.  MPACS  Objectives 

The  development  philosophy  of  the  program  is  that  it  is 
more  productive  to  build  a  complete,  working 
qualification  model  (QM)  of  the  satellite  rather  than 
focus  on  individual  component  testing.  This  fits  very 
well  within  the  academic  structure  and  allows  one  class 
to  build  a  working  satellite  that  is  subject  to 
qualification  levels.  The  avionics  in  the  QM  also  serve 
the  purpose  of  an  avionics  test  bed  (ATB)  that  is  used 
for  software  development,  operator  training,  and  on- 
orbit  anomaly  resolution. 

The  last  item  built  is  the  actual  flight  model  (FM)  of 
FalconSAT-3  and  that  is  subjected  to  acceptance  level 
testing  for  vibration  and  shock  and  for  thermal  cycling 
inside  a  vacuum  chamber.  The  facilities  at  USAFA  are 
limited  and  for  each  of  these  major  tests  the  satellite  is 
transported  to  Kirtland  Air  Force  Base  (KAFB)  in 
Albuquerque,  New  Mexico  where  the  large  shaker 
tables  and  thermal-vacuum  chambers  are  used.  While 


antenna  test  ranges  have  been  used  to  determine  the 
gain  patterns  off  antennas  on  the  spacecraft  controlled 
EMI/EMC  test  are  usually  not  conducted. 

3.2.  SEM  and  QM  Environmental  Testing  Results 

The  SEM  and  QM  tests  were  very  successful  in 
qualifying  the  structure  and  in  uncovering  potentially 
catastrophic  failures  that  would  have  inhibited  on-orbit 
operations.  The  first  issue  identified  during  vibration 
testing  was  that  a  small  UHF  whip  antenna  could 
resonate  in  a  mode  that  caused  it  to  get  inadvertently 
captured  in  the  structure  of  one  of  the  S-band  antennas. 
This  was  quickly  fixed  after  testing  by  configuring  the 
UHF  antenna  in  a  different  orientation.  The  second 
issue  was  more  severe  and  significantly  impacted  the 
program. 

The  original  design  of  the  satellite  included  a  gravity 
gradient  boom  that  was  a  research  and  development 
endeavour  of  Air  Force  Research  Faboratory  (AFRF). 
The  vendor  providing  a  composite  memory  material 
delivered  the  item  several  months  late,  non-functioning, 
and  not  meeting  the  required  mass  and  volume 
constraints.  The  educational  value  to  the  students  in 
dealing  with  research  and  development  activities  was 
very  significant  but  also  caused  them  to  pursue  other 
alternatives.  The  second  gravity  gradient  boom  procured 
was  supposed  to  have  significant  flight  heritage. 
However,  after  that  boom  arrived  and  underwent  testing 
it  failed  at  very  low  levels  of  vibration.  The  cadets 
attempted  several  fixes  of  the  boom  but  the  design  and 
manufacture  were  fundamentally  flawed  and  after 
several  months  of  effort  -  and  launch  vehicle  integration 
rapidly  approaching  -  the  cadets  were  forced  to  initiate 
an  emergency  procurement  of  a  more  sophisticated 
COTS  gravity  gradient  boom  with  a  long  heritage  of 
successful  flights.  However  this  also  required  a  change 
from  an  electromechanical  release  mechanism  to  one 
that  used  pyrotechnic  cable  cutters.  While  this  was  a 
standard  technique  in  the  industry  it  was  a  last  minute 
change  to  all  of  the  safety  submittals  to  the  launch 
vehicle  integrator  and  range  safety  office.  That  became 
the  definition  of  another  learning  opportunity  for  young 
engineers. 

The  new  vendor  was  required  to  demonstrate  successful 
deployment  and  the  satellite  team  was  required  to 
develop  and  test  a  new  firing  circuit.  This  was  the  one 
exception  to  the  general  testing  philosophy  where  the 
components  were  qualification  and  acceptance  tested  as 
components  and  bolted  onto  the  satellite  after  final 
acceptance  testing  of  the  FM. 

One  other  object  of  the  SEM  and  QM  environmental 
testing  was  to  determine  what  performance  of  the  shock 
ring  was  required.  The  use  of  a  lightband  as  a  separation 
system  meant  that  the  satellite  fundamental  frequency 
would  appear  to  be  lowered  since  the  compressed 


lightband  does  have  some  lower  frequency  modes  than 
the  relatively  stiff  aluminium  box  that  comprises  the 
satellite  body.  The  instrumented  results  of  the  SEM 
indicated  that  the  response  function  of  the  shock  ring 
needed  to  be  modified.  Analysis  of  the  test  data  allowed 
the  vendor  to  re-design  a  different  response  function 
into  the  shock  ring  and  the  result  of  that  effort  was  a 
successful  QM  test. 


The  thermal  cycling  testing  in  the  vacuum  chamber 
went  from  -20  C  to  50  C  to  qualify  the  components  and 
all  components  functioned  properly.  The  real  benefit  of 
this  full  environmental  testing  of  the  QM  was  that 
assembly  and  integration  of  the  FM  could  proceed  as 
planned. 

3.3.  FM  Environmental  Testing  Results 


For  a  secondary  payload  on  a  complex  launch  the 
successful  completion  of  the  environmental  testing  is 
absolutely  critical  to  the  launch  vehicle  integrator  since 
this  is  what  ensures  that  the  secondary  satellite 
introduces  no  risk  for  the  launch  vehicle  or  primary 
payload.  Any  hint  of  risk  and  the  secondary  payload 
will  be  immediately  removed  from  the  flight  manifest 
and  required  to  provide  a  mass  dummy  of  the  satellite  to 
ensure  that  all  of  the  previously  calculated  rocket  loads 
are  constant.  As  an  aside,  the  requirement  for  a 
secondary  payload  to  provide  a  substitute  mass  dummy 
in  the  event  that  the  FM  cannot  be  delivered  is  a 
significant  cost  to  a  small  satellite  program. 
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Figure  11.  Gravity  Gradient  Boom  History 


As  FalconSAT-3  FM  was  completed  and  prepared  for 
environment  testing  the  previously  mentioned  problems 
with  the  gravity  gradient  boom  had  been  identified  and 
resolved  and  the  testing  schedule  for  the  FM  had  to 
proceed  without  the  boom.  As  a  result  a  mass  dummy  of 
the  deployable  boom  was  used  during  acceptance 
testing  of  the  FM.  The  vibration  testing  of  the  satellite 
was  successfully  completed  and  the  satellite  completed 
all  functional  testing. 


However,  after  the  FM  satellite  went  into  the  vacuum 
chamber  two  component  failures  appeared.  The  first 
failure  was  that  only  9  of  the  12  MPACS  tubes  were 
able  to  fire.  There  was  a  custom  FPGA  driver  circuit  for 


all  of  the  MPACS  tubes  and  it  appeared  that  one  or 
more  output  gates  of  the  FPGA  probably  failed.  The 
dilemma  at  this  time  was  that  the  satellite  structure,  the 
avionics  stack,  and  the  tray  with  the  firing  circuit  would 
have  to  be  disassembled.  That  level  of  disassembly 
would  require  a  complete  retesting  of  the  satellite  to 
acceptance  levels  after  repair  (if  possible  given  schedule 
constraints)  and  it  was  determined  that  the  extra  testing 
cycles  of  the  satellite  would  introduce  risk  into  the 
program.  Unfortunately  for  the  MPACS  principal 
investigators  that  meant  the  satellite  would  launch  with 
25%  of  the  experiment  non- functional.  From  an 
educational  perspective  it  was  one  more  important 
learning  experience  for  the  team  of  how  they  must 
balance  cost,  schedule,  technical  risk,  and  program  risk. 

>  NGST  boom  has  new  pyrotechnic  release  device 

>  New  firing  circuit  designed,  built,  and  tested  at  USAFA 

>  Inadvertent  boom  deployment  and  pyrotechnic  safety  issues  resolved  in 
Mission  System  Program  Safety  Plan  (MSPSP)  process 


Figure  12.  New  Pyrotechnic  Firing  Circuit  Added 


The  second  failure  in  thermal  cycling  was  more 
troubling  and  more  ambiguous.  Acceptance  testing  of 
the  FM  was  done  between  -10  C  and  40  C  since  the 
expected  on-orbit  environment  was  0  C  to  30  C.  After 
cold  soaking  at  -10  C,  the  flight  processor  (IFC)  failed 
to  start  when  the  separation  switch  was  tripped.  This  test 
was  repeated  several  times  and  in  every  instance  the 
IFC  would  eventually  power  ON  when  a  temperature  of 
~5  -  7  C  was  reached.  This  anomaly  could  not  be 
replicated  on  the  QM  avionics  (which  had  worked  at  -20 
C)  and  provided  the  cadets  with  a  hugely  important  risk 
analysis  task  to  perform.  FalconSAT-3  was  to  be  the  last 
satellite  to  be  dropped  off  after  approximately  40 
minutes  and  was  exposed  to  either  darkness  of  sun 
during  that  time  as  a  function  of  when  the  launch 
actually  took  place.  The  Fockheed  and  Boeing  teams 
had  performed  detailed  thermal  analyses  for  the 
secondary  payloads  and  the  worst  case  for  FalconSAT-3 
indicated  a  possible  cold  temperature  of  5  -  7C;  exactly 
where  the  dividing  line  between  success  and  failure 
occurred.  The  cadets  formally  evaluated  the  risks  of: 
assembly  /  disassembly  (impact  on  future  testing); 
successfully  troubleshooting  the  circuit  (what  if  it  was  a 
thermal  transient  that  could  not  be  repeated?);  schedule 
(could  there  be  a  replacement  in  time  from  the  vendor?); 
budget  (already  tight  with  minimal  margin);  and 
probability  of  the  IFC  surviving  this  environment  with 
no  changes.  The  cadets  weighed  these  considerations 
and  decided  to  launch  and  integrate  as  is. 


4.  LAUNCH  VEHICLE  INTEGRATION 


The  integration  of  FalconSAT-3  onto  the  launch  vehicle 
was  a  simple  as  had  been  planned.  Functional  testing  of 
the  satellite  revealed  that  all  systems  were  operating  as 
expected  and  a  lifting  harness  allowed  for  the  satellite  to 
be  lifted  off  of  the  shipping  container  and  rotated  90 
degrees  for  integration  onto  the  ESPA  ring.  24  bolts, 
and  two  connectors  later,  the  satellite  was  fully 
integrated  and  ready  for  encapsulation.  The  flight 
harness  was  connected  and  the  battery  voltage  was 
checked  and  the  battery  was  found  to  be  fully  charged. 


every  few  days  instead  of  every  30  -  60  days  as  had 
been  planned. 


5.  EARLY  ON-ORBIT  OPERATIONS 


The  launch  of  STP-1  occurred  at  Kennedy  Space  Center 
on  8  March  2007  and  the  nighttime  launch  was 
spectacular  for  both  its  vivid  plume  and  the  fact  that 
every  one  of  the  satellites  was  separated  on  time  and  in 
the  correct  orbit.  FalconSAT-3  was  the  last  satellite 
separated  and  the  initial  state  vectors  were  relayed  to  the 
ground  station  at  USAFA.  First  contact  could  not  occur 
for  several  orbits. 


Figure  13.  STP-1  Mission  Configuration 

The  battery  system  on  FalconSAT-3  consists  of  seven 
NiCad  6D”  cells  rated  at  4  A-hr  each.  These  batteries 
have  a  significant  flight  heritage  and  have  proven  to  be 
remarkably  robust.  The  flight  cells  used  in  the  satellite 
were  only  three  years  old  at  the  time  of  launch  and  had 
plenty  of  shelf  life  left.  Testing  with  the  batteries 
indicated  that  there  was  a  self  discharge  rate  less  than 
0.75  mV/hr.  However  when  the  batteries  were  checked 
just  prior  to  encapsulation  6  weeks  later,  the  battery 
voltage  had  dropped  to  less  than  1.0  V  on  a  nominal  9.8 
V  power  bus.  The  battery  voltage  should  have  been 
approximately  8.1  V  and  this  complete  discharge  of  the 
batteries  to  approximately  0.1  V  per  cell  was  the  source 
of  significant  concern.  Initial  attempts  to  re-charge  the 
batteries  through  the  umbilical  cable  were  only  partially 
successful  until  the  charging  procedures  were  changed 
to  reflect  the  increased  resistance  of  the  500  foot  cable. 
The  batteries  were  very  carefully  charged  (while 
monitoring  temperature)  and  the  apparent  discharge  rate 
was  measured  for  several  days.  For  reasons  that  are  still 
not  clear  (leakage  in  the  cable?,  spacecraft  internal 
faults?).  The  batteries  now  demonstrated  a  lOx  increase 
in  discharge  rate  to  6.6  mV/hr. 

The  decision  at  this  point  was  simple  -  leave  the 
satellite  as  is  for  encapsulation  and  charge  the  batteries 


The  planned  operational  sequence  for  FalconSAT-3  was 
to  turn  on  the  IFC  and  the  receivers  (VHF  and  UHF) 
immediately  after  separation.  The  sequence  is  as 
follows: 

1.  Power  to  the  IFC  causes  it  to  execute  the 
bootloader  code  in  the  processor  PROM 

2.  The  PROM  containing  the  bootloader  code  is 
socketed  and  has  been  tested  extensively  on 
both  the  QM  and  FM  versions  of  the  satellite 

3.  The  bootloader  writes  the  base  flight  code  from 
FLASH  (EPROM)  memory  into  the  error 
detection  and  correction  (ED AC)  memory. 

4.  The  flight  code  then  starts  executing  and  waits 
for  the  first  command  received  from  the 
USAFA  ground  station  to  turn  on  the 
transmitter  and  start  broadcasting  telemetry. 

6  hours  after  separation  the  USAFA  ground  station 
attempted  communication  with  FalconSAT-3.  No 
signals  at  all  were  detected  on  the  spectrum  analyzers. 
TLEs  were  checked  and  for  the  next  several  days 
attempts  were  made  to  communicate  with  the  satellite 
on  both  the  UHF  and  VHF  uplinks  with  no  indications 
at  all  of  any  signals  from  the  satellite. 

The  operations  crew  also  made  several  attempts  to  reset 
the  IFC  using  a  “firecode”  signal  that  sends  a  simulated 
watchdog  timer  reset  to  the  CPU.  Unfortunately  this  is 
not  a  true  watchdog  timer  reset  since  there  is  no  power 


cycling  of  the  processor.  This  signal  resets  the  vectors 
on  the  CPU  in  the  IFC  and  clears  the  states  to  a 
supposedly  known  state. 

After  a  firecode  reset  signal  to  the  satellite  the 
bootloader  starts  its  initialization  and  flight  code  loading 
sequence.  If  that  process  can  be  interrupted  within  30 
seconds  of  a  reset  then  the  IFC  executes  just  the  simple 
bootloader  commands.  Since  USAFA  did  not  have 
access  to  the  source  code  of  the  bootloader  the  vendor 
was  enlisted  to  attempt  communication  with  the 
satellite.  The  vendor  was  able  to  reset  and  then  freeze 
the  bootloader  process  so  that  it  became  possible  to 
communicate  with  what  is  essentially  the  BIOS  on  the 
satellite  processor. 


Figure  15.  FalconSAT-3  IFC 


The  anomaly  resolution  process  had  started  formally 
after  failure  to  communicate  with  FalconSAT-3  but  no 
data  of  significance  could  be  accomplished  until  there 
was  some  form  of  rudimentary  communication.  Possible 
causes  of  the  anomaly  identified  included: 

1.  Transmitter  or  receiver  failure:  This  was  the 
only  redundant  system  and  all  of  the  hardware 
had  an  extensive  flight  heritage. 

2.  IFC  cold  start  failure:  While  ground  thermal 
testing  had  uncovered  this  problem  there  was 
never  a  case  where  the  IFC  failed  to  start  after 
warming  past  1C-  and  the  predicted 
temperature  during  a  sunlight  pass  over  the 
ground  station  exceeded  that  point. 

3.  Software:  Some  how  the  bootloader  code  was 
corrupted  but  that  was  in  the  most  reliable 
memory  (PROM)  on  the  spacecraft. 

4.  Separation  switches  some  how  did  not  operate 
but  they  are  mechanical  devices  and  the 
satellite  was  definitely  separated  from  the 
launch  vehicle. 

5.  Power:  Somehow  the  batteries  had  become 
completely  discharged  in  24  hours  and  were 
not  capable  of  recharging  on  orbit;  but  the 
battery  discharge  rate  monitored  prior  to 
launch  was  small  enough  to  allow  for  ten  days 
of  holding  capacity. 

6.  Flight  code  corrupted  in  FLASH  memory:  but 
this  chipset  had  been  extensively  tested  with 
no  failures. 


When  communication  with  the  bootloader  program  was 
established  it  did  provide  limited  telemetry  that 
determined  the  battery  voltage  and  temperature  were 
normal  and  that  there  were  no  obvious  hardware 
failures.  The  next  question  was  to  determine  why  the 
satellite  could  not  successfully  load  and  execute  the 
flight  code. 


Figure  16.  FalconSAT-3  Boot  Sequence 


The  next  step  in  the  anomaly  resolution  process  was  to 
download  a  memory  map  of  the  flight  code  in  the 
FLASH  memory.  As  soon  as  that  was  accomplished  and 
the  memory  map  examined  it  was  clear  that  the  FLASH 
memory  had  some  how  been  dramatically  corrupted 
sometime  after  the  last  functional  test  prior  to 
encapsulation  and  before  6  hours  of  post-separation 
activity  on  orbit.  An  examination  of  the  pattern  of 
memory  corruption  made  it  unlikely  that  a  radiation 
event  had  been  responsible.  At  this  point  it  was  not  clear 
whether  or  not  that  section  of  FLASH  memory  had  been 
permanently  damaged.  It  was  deemed  advisable  to 
contract  the  vendor  to  provide  a  “crutch”  modification 
to  the  bootloader  code  that  would  enable  an  upload  of 
new  flight  code  to  a  different  part  of  FLASH.  That 
crutch  program  was  delivered  to  USAFA;  the  original 
flight  code  was  uploaded  to  a  different  part  of  FLASH 
and  then  commissioning  was  able  to  begin  25  days  after 
launch. 


It  is  impossible  to  overstate  the  value  of  the  educational 
lesson  for  the  students  in  this  situation.  This  was,  and  is, 
a  real  mission  with  a  paying  customer  and  not  just  a 
homework  exercise.  With  appropriate  guidance  from 
faculty  and  various  professionals  in  the  industry  the 
cadets  were  able  to  thoroughly  explore  a  variety  of 
causes  and  slowly  work  through  the  problems  and 
recover  satellite  operations. 

6.  OPERATIONAL  CHALLENGES 

Once  commissioning  was  started  the  procedures 
developed  by  the  cadets  were  followed  to  determine  the 


state  of  health  and  functioning  of  all  systems  on  the 
satellite.  The  magnetometer  and  torque  rods  were 
individually  tested  and  appeared  to  be  working 
normally.  When  the  first  control  mode  was  initiated  to 
de-tumble  the  satellite  it  was  immediately  apparent  that 
the  torque  rod  magnetic  fields  were  completely 
swamping  the  magnetometer  and  rendering  that  output 
useless.  This  had  been  tested  on  the  ground  and  there 
was  no  interference  but  on  orbit  there  was  a  different 
response.  A  modification  to  the  flight  software  was 
written  that  turned  the  torque  rods  OFF  whenever  the 
magnetometer  was  read.  That  fix  solved  the  corrupted 
magnetometer  reading  problem  and  the  remaining 
systems  functioned  as  expected. 
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Figure  1 7.  Battery  Situation  After  Integration 


At  this  point  the  gravity  gradient  boom  was  not  yet 
deployed  and  the  science  payloads  were  run  through 
diagnostic  modes  to  determine  their  operability.  As  the 
pace  of  ground  operations  picked  up  and  more  and  more 
files  were  generated  on  orbit  and  subsequently 
downloaded  for  analysis  by  the  operations  crew.  On 
board  storage  on  FalconSAT-3  consists  of  two,  16  MB 
SRAM  banks  that  are  operated  as  a  single  32  MB  file 
system.  The  onboard  software  is  designed  to  delete  the 
oldest  file  in  memory  when  the  file  system  becomes 
full.  The  operators  on  the  ground  did  not  have  the 
ability  to  selectively  delete  files  from  spacecraft 
memory  and  free  up  space  for  new  files.  Testing  on  the 
ground  appeared  to  confirm  proper  operation  of  the 
memory  but  operations  on  orbit  suddenly  came  to  a  halt 
when  the  memory  was  full  and  files  were  not 
automatically  deleted.  The  net  result  was  a  software 
collapse  on  orbit  that  required  the  operators  to  re-boot 
the  satellite  and  clear  the  memory.  The  re-boot  process 
now  worked  well  and  the  operators  became  very 
qualified  in  reloading  all  of  the  flight  software  from  the 
ground  at  each  reset. 


One  of  the  unique  aspects  of  space  education  at  USAFA 
is  the  existence  of  a  Space  Operations  academic  major. 
In  addition  cadets  from  all  academic  backgrounds 
volunteer  to  learn  how  to  operate  the  satellite  and  they 
have  the  opportunity  to  participate  in  as  many 
operational  passes  as  their  schedule  allows.  The  satellite 


operators  are  very  familiar  with  the  details  of  the 
satellite  and  are  expected  to  be  able  to  handle  most 
types  of  situations  on  their  own.  There  is  a  formally 
established  Operations  Requirements  Working  Group 
(ORWG)  that  meets  weekly  and  develops  plans  for 
operating  the  satellites.  The  operational  crew  structure  is 
modeled  after  satellite  operations  in  the  United  States 
Air  Force  and  the  cadet  crews  exercise  FalconSAT-3  in 
a  manner  similar  to  how  they  will  operate  other 
satellites  during  their  careers. 

Several  other  anomalous  events  have  occurred  during 
the  first  fifteen  months  of  on-orbit  operations  that  have 
continued  to  educate  -  and  stress  -  the  satellite 
operators  and  astronautical  engineering  majors  who 
provide  technical  backup. 


Figure  18.  Battery  Test  Results 

The  PLANE  instrument  has  worked  very  well  from  the 
beginning  of  operations  and  experiments  with  data 
downloads  are  routinely  accomplished.  Experiments  are 
run  on  the  MPACS  payload  to  determine  lifetimes  of 
the  individual  tubes.  Attempts  to  measure  the  small 
amount  of  torque  provided  by  the  MPACS  tubes  have 
been  unsuccessful  to  date  for  reasons  associated  with 
the  performance  of  the  ADCS  system  described  below. 

Extracting  useful  data  from  FLAPS  has  continued  to  be 
problematic  for  several  reasons.  Diagnostics  on  the 
payload  seem  to  indicate  that  the  high  voltage  power 
supplies  and  the  micro-channel  plate  (MCP)  are 
working  properly.  However,  data  going  from  the 
payload  to  the  IFC  over  a  serial  port  has  experienced 
random  loss  of  bytes  and  occasional  file  writing 
problems  because  of  the  issues  with  the  file  system.  The 
file  system  software  has  been  replaced  and  the  satellite 
is  now  able  to  automatically  delete  old  files  to  make 
room  for  new  files.  The  random  loss  of  data  from 
FLAPS  appears  to  be  caused  by  an  unknown  source  of 
interrupts  to  the  IFC.  FLAPS  task  software  has  been 
modified  to  run  at  a  higher  priority  in  the  operating 
system  with  some  minimal  improvement  in 
performance. 

The  biggest  continuing  anomaly  is  the  poor 
performance  of  the  attitude  control  system.  At  launch  it 


was  known  that  reading  the  sun  sensors  in  a  timely 
manner  too  long  and  was  interfering  with  IFC 
operations.  The  software  was  re-written  to  operate  the 
satellite  control  system  using  only  magnetometer  input. 
Cadets  wrote  variations  on  Kalman  filter  that  reliably 
generate  good  attitude  knowledge  information  with  only 
magnetometer  data  and  those  codes  have  been  used  on 
the  ground  to  post-process  FalconSAT-3  telemetry.  The 
general  limitations  of  attitude  reconstruction  using  this 
method  involve  using  linearized  models  of  the  satellite 
dynamics  that  are  only  valid  when  the  motion  of  the 
satellite  satisfies  the  small  angle  approximations 
inherent  in  a  linear  model. 

The  performance  of  the  standard  B-dot  controller 
algorithms  has  been  very  poor  to  date  and  investigations 
have  revealed  two  problems.  The  first  was  a  minor 
software  error  that  resulted  in  the  wrong  magnitude 
command  being  sent  to  the  torque  rods.  That  was  fixed 
but  the  performance  improved  only  slightly.  At  this 
point  it  appears  that  there  is  a  random  and  subtle 
disturbance  to  the  magnetometer  readings  that  causes 
the  polarity  of  the  torque  rod  commands  to  change 
quickly  and  incorrectly.  Higher  order  filters  are  being 
written,  tested,  and  prepared  for  upload  to  the  satellite. 

7.  FUTURE  PLANS  AND  EXPERIMENTS 

FalconSAT-3  has  operated  on  orbit  for  almost  fifteen 
months  and  is  expected  to  last  at  least  that  much  longer 
on  orbit.  The  fundamental  issues  uncovered  have  in 
most  cases  been  fixed  and  every  one  of  these 
experiences  has  contributed  significantly  to  the 
education  of  the  students  in  the  program. 

Resolution  of  the  final  ADCS  and  FLAPS  interface 
problems  will  be  solved  by  very  carefully  backing  down 
the  software  requirements  on  the  IFC  and  modifying 
ADCS  software  to  accommodate  the  corrupted 
magnetometer  data.  The  fundamental  issue  is  one  of  far 
too  many  tasks  required  of  the  single  IFC.  This  is  a  286- 
class  microprocessor  without  a  hardware  floating  point 
capability  and  floating  point  calculations  are  done  in  an 
emulator.  The  original  requirements  for  the  satellite 
continued  to  grow  after  hardware  selection  was  made 
and  the  goal  now  is  to  restructure  some  of  the  original 
code  to  work  as  well  as  possible  within  the  limited 
cycles  available. 
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